World’s Top Student Hackers Advance to Final Rounds of NYU Cyber Security Awareness Week Games

After 48 hours of round-the-clock software hacking, 15 teams of college students—with two high school students in the mix— bested a pool of more than 2,000 teams to take the finalist slots in the world’s biggest student cybersecurity contests at New York University Tandon School of Engineering’s annual Cyber Security Awareness Week (NYU CSAW) games.

The hacking skills contest, called Capture the Flag (CTF), is the signature event of NYU CSAW, which draws tens of thousands of students every year through online preliminaries and sends the finalists to compete in six in-person events at the school’s Downtown Brooklyn campus.

Capture the Flag events are essential training competitions for students interested in cybersecurity careers. Designed to test a range of both offensive and defensive skills, including vulnerability testing, exploit discovery, and reverse engineering, CTFs are widely used to train both students and security industry professionals. As competitors advance through the challenges, they earn points, or “flags,” with winners qualifying for cash prizes and trips to New York City for the CSAW finals November 12-14, 2015.

Fifteen teams will compete at the CSAW CTF Finals in New York:

1. 1064CBread,  University of California, Santa Barbara; California Institute of Technology (Pasadena); Dos Pueblos High School (Goleta, CA); Thomas Jefferson High School of Science and Technology (Alexandria, VA).
   
   Team members: Andrew Dutcher (UCSB), Alex Meiburg (Caltech), John Grosen (DPHS), Samuel Kim (TJHS)

2. asciioverflow, University of Tulsa
   Team members:  Ryan McCarthy, Michael Frohlich, Matthew Hruz, Gavin Bauer

3. BatmansKitchen, University of Washington (Seattle)
   Team members: Bo Wang, Stanley Hsieh, Alex Kirchhoff, Dan Arens

4. bitsforeveryone, United States Military Academy (West Point, NY)
   Team members: Jessie Lass, Ed Woodruff, Chris Maixner, Matt Shockley

5. DCIETS, École de technologie supérieure (Montreal)
   Team members: Félix Cloutier, Israel Hallé, Benoit Côté-Jodoin, Alex Bouffard

6. dcua, University of Toronto
   Team members: Dongseon Kim, Harold Kim, Richard Song, Inho Shin

7. jmp-esp, Georgia Institute of Technology (Atlanta)
   Team members: Siddarth Senthilkumar, Alok Tripathy, Manas George, Kennon Bittick

8. Knightsec, University of Central Florida (Orlando)
   Team members: Ditmar Wendt, Mark Ignacio, Kirk Elifson, Alex Lynch

9. NYUSEC, NYU Tandon School of Engineering
   Team members: Christopher Thompson, Josh Hofing, Nick Gregory, Matt Foley

10. PPP1, Carnegie Mellon University (Pittsburgh)
    Team members: Ned Williamson, Tim Becker, Chris Ganas, Richard Zhu

11. PPP3, Carnegie Mellon University (Pittsburgh)
    Team members: Matthew Savage, Zachary Wade, Corwin de Boor, Eric Sun

12. RPISEC, Rensselaer Polytechnic Institute (Troy, NY)
    Team members: Patrick Biernat, Branden Clark, Austin Ralls, Nick Burnett

13. RPISEC2, Rensselaer Polytechnic Institute (Troy, NY)
    Team members: Avraham "Avi" Yonah Weinstock, Galen Tyler Schretlen, Kareem Mohammed El-Faramawi, Joshua Josephs Ferrell

14. Shellphish, University of California, Santa Barbara
    Team members: Siji Feng, Jake Corina, Mark Mossberg, Schuyler Rosefield

15. Uiuctf, University of Illinois at Urbana-Champaign
    Team members: David Jiang, Eric Hennenfent, John Paul Smith, Will Song

The online qualifying round of CSAW CTF is open to competitors at all levels, and is designed to encourage novices as well as challenge professionals. This year, the event drew 2,454 teams from 92 countries. Interest in CTF events has skyrocketed in recent years, as more students are exploring careers in cybersecurity—one of the fastest-growing and most lucrative fields in the sciences due in part to high demand and a low supply of highly trained workers. In 2011, just 209 teams scored points in the CSAW CTF. This year, more than six times that number—1,367 teams—scored in the event.

“The booming interest in CTF, and the skill level of those participating in all CSAW events, is very exciting,” said Nasir Memon, NYU CSAW founder and chair of the Tandon School of Engineering’s Department of Computer Science and Engineering. “Over the past 12 years, we’ve grown CSAW into an event for anyone interested in computer security, from the high school level all the way through doctoral candidates and professionals. CSAW is legendarily hard but it’s also incredibly fun—there’s no better way to capture students’ interest in this vital field.”

One finalist team, 1064CBread, has two high school and two college members, and is the only CTF finalist team that includes high school competitors. The team formed at Dos Pueblos High School several years ago, and despite half of its members graduating and going to college, the group continues to compete together and will reunite at CSAW.

This year is also the first in many that a team from the NYU School of Engineering has qualified for the CTF Finals, a phenomenon explained by the nature of NYU CSAW itself. “CSAW challenges are designed by students with guidance from faculty, and our top students are usually occupied with creating the event,” explained Eric Liang, a senior majoring in computer science at the NYU Tandon School of Engineering and the Student Leader for CSAW CTF.

On the opposite end of the spectrum from open-to-all Capture the Flag is the NYU CSAW Embedded Security Challenge—the oldest and largest hardware hacking competition in the world— and the most difficult event at CSAW. This year’s challenge, designed by a team of top NYU security faculty and students, involves the corruption of digital voting systems. Submissions from elite student competitors from universities around the world resulted in seven finalist teams, who will compete in Brooklyn at the CSAW Finals:

1. LCIS, Grenoble Institute of Technology (France)
   Team members: Isabelle Boulay, Jeremy Dubeuf, Arash Nejat

2. LOGICS, University of South Florida (Tampa)
   Team members: John Gangemi, Sebastian Otero

3. MESHsec, University of Maryland, College Park
   Team members: Tanvir Arafin, Mingze Gao, Qian Wang

4. No Comment, University of Illinois at Urbana-Champaign
   Team members: Peter Fischer, Hiroshi Fuji, Duyen Le

5. SSL, University of Central Florida (Orlando)
   Team members: Orlando Arias, Jacob Wurm, Khoa Hoang

6. TRELA, University of Texas, Dallas
   Team members: Gaurav Rajavendra Reddy, Liwei Zhou, Mohammad-Mahdi Bidmeshki

7. Wildcats, University of New Hampshire (Durham)
   Team members: William Melanson, Chenghua She, Jaya Dofe

Other highlights of the 12th annual NYU CSAW Games are:

• A newly expanded High School Forensics challenge put thousands of young competitors to the test, sifting through digital forensic data in the hope of becoming one of the 12 finalist teams traveling to NYU CSAW solve a murder mystery.

• The Policy Competition, which tasks entrants with designing proposals to solve controversial real-life dilemmas in cybersecurity. This year’s contest asks, “Should the United States implement a national ‘bug bounty’ program?”

• Presentations from keynote speaker Brendan Hannigan, general manager of IBM Security, and featured speaker Neil Herschfield, deputy section manager for Homeland Security’s Industrial Control Systems Cyber Emergency Response.

• The Homeland Security Quiz, a lightning-fast security trivia game and a longtime CSAW favorite.

• Elite graduate and doctoral students will present recently published security research in the Applied Research Competition.

• Twenty-eight prestigious tech employers will be eagerly seeking CSAW competitors for internships and full-time positions at the Career Fair.

• CSAW finalists will learn what it takes to start and fund their own companies from tech entrepreneurs and venture capitalists during a workshop presented by the NYU Incubators.

• In an effort to counter the acute shortage of women in the field, Goldman Sachs will offer a mini-version of NYU Tandon’s annual Career Discovery in Cybersecurity: A Women’s Symposium.

Sponsors for CSAW 2015 are Gold Level—U.S. Department of Homeland Security; Silver Level—Goldman Sachs, GitHub, IBM (which will also host the welcome reception and a networking event for CTF and High School Forensics finalists), and MWR Info Security; Bronze—Facebook, FireEye, LifeLock, Navy Civilian Careers-U.S. Navy, NCC Group USA, Oceans Edge Inc., Palentir, Palo Alto Networks, Qualcomm Inc., Raytheon, Two Sigma, and Yelp; Supporting Level—Accuvant, Cubic, Cypher Tech Solutions, Intel Corporation, LIFARS, MIT Lincoln Laboratory, PWC, Rakuten Loyalty, Sandia National Laboratories, and the U.S. Secret Service.  The Center for Advanced Technology in Communications at the NYU School of Engineering is a CSAW partner.

For more information or to register, visit csaw.engineering.nyu.edu.

The NYU Tandon School of Engineering dates to 1854, when the NYU School of Civil Engineering and Architecture as well as the Brooklyn Collegiate and Polytechnic Institute (widely known as Brooklyn Poly) were founded. Their successor institutions merged in January 2014 to create a comprehensive school of education and research in engineering and applied sciences, rooted in a tradition of invention, innovation and entrepreneurship. In addition to programs at its main campus in downtown Brooklyn, it is closely connected to engineering programs in NYU Abu Dhabi and NYU Shanghai, and it operates business incubators in downtown Manhattan and Brooklyn.